Computer networks are quite prevalent in the art now which provide for one or more server machines interconnected in a network fashion to multiple client machines generally of lesser capability. There are numerous benefits to this arrangement. For example unnecessary replication of more expensive hardware at the clients is avoided which might otherwise be shared by multiple clients if located at a central repository.
In such networks, it is common to provide the client machines in the form of medialess or diskless workstations. These machines have no substantial (and generally more expensive) non-volatile mass storage devices such as DASD or the like. Rather, they rely upon mass storage devices such as at servers at other locations in the network to store the necessary code and data which must be available to the client machines to perform their functions. In such arrangements, it is conventional for the server(s) to deliver the code and data over the network connection to the particular client at appropriate times. In this manner, the client need only have present in its real memory at any given time only the information stored in the mass storage devices at the server(s) necessary to perform a function at that time. The need is thereby avoided of having mass storage devices at each client containing information which remains in an unused state for long periods of time and which adds to the cost of the network.
Representative such client-server systems may be seen described in U.S. Pat. No. 5,056,140 entitled "Communication Security Accessing System and Process" and U.S. Pat. No. 4,958,278 entitled "Method for Loading Data or Program to a Plurality of Terminal Stations", for example.
Several problems have come about as a result of the growth of these computer network systems. Not the least of these is the serious problem of unauthorized access to the systems which has been reported with alarming increased frequency. With the proliferation of large multi-user computer systems with enormous banks of extremely valuable data, techniques were highly sought for enhancing the security of these networks.
Accordingly, numerous schemes have developed over the years including encryption, passwords, physical security devices such as keyed switches, and so forth in an effort to deter the rising rates of unauthorized access. Several subtle security exposures arise from the characteristics of the diskless workstation in seeking to secure the previously described network systems which employ diskless workstations. As but one example, in order for such a workstation to become operative upon power up, it is necessary for the workstation to obtain the kernel operating system code from somewhere else in the network. This is because the operating system is not resident at the workstation itself (for reasons previously described that the non-volatile storage necessary to store the operating system at the workstation is undesirable and cost-prohibitive.) One problem with this, however, is that the industry standard boot protocol does not provide for certification of this kernel code delivered from the network to the booting diskless workstation in any way.
The delivery of non-certified boot code to a workstation upon booting is fraught with numerous problems which have beset the industry, particularly in the more security-sensitive areas in which computer networks have been established. As but one example, one of the computers in the network could be configured to provide a kernel to a diskless system when it boots. It may be assumed, for purposes of illustration, that this kernel-providing system may be faster at providing such kernel code than the "officially" designated kernel source machine for the network. In such a case, upon booting of the diskless workstation, the non-certified kernel from the computer will be loaded by the workstations which then, in response, might very typically be asked to supply a password. Upon the password being provided by the operator at the workstation, this password would be received by the computer providing the bogus boot kernel code requested by the workstation. Later, the unauthorized individual, who has thereby surreptitiously obtained the valid password from the workstation operator, could sign onto the network system, utilize the thus-obtained valid password, and unauthorizedly enter the entire computer network.
In an effort to solve the foregoing problems, numerous solutions were attempted resulting in customer requirements for diskless stations, networks and modifications which were not appropriate or cost-effective for systems not requiring such security. This resulted in manufacturing expenses and costs associated with providing two types of systems.
Accordingly, systems and methods were needed which could provide assurances that a diskless workstation was obtaining a certified kernel upon booting, and which could further ensure the kernel server that the workstation machine requesting the kernel was an authorized workstation.
It was accordingly an object of the invention to provide an improved boot architecture.
Yet another object of the invention is thus to provide an improved communication security system for diskless workstations which rejects connection to an unauthorized user terminal.
Still another object was to provide for a boot architecture for secure initial program load (IPL) for diskless workstations which nevertheless provided the ability to offer one standard diskless station with only minimal modifications being required for the addition of a secure IPL feature.
These and other objects and features are provided by the invention, a fuller understanding of which may be obtained with reference to the following description taken in connection with the accompanying drawings, wherein: